[secdir] secdir review of draft-harkins-emu-eap-pwd-04.txt
Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> Wed, 22 July 2009 15:57 UTC
Return-Path: <j.schoenwaelder@jacobs-university.de>
X-Original-To: secdir@core3.amsl.com
Delivered-To: secdir@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 771873A681E; Wed, 22 Jul 2009 08:57:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.299
X-Spam-Level:
X-Spam-Status: No, score=-1.299 tagged_above=-999 required=5 tests=[AWL=0.350, BAYES_00=-2.599, HELO_EQ_DE=0.35, J_CHICKENPOX_33=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VfWeO-CD-Dlh; Wed, 22 Jul 2009 08:57:07 -0700 (PDT)
Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by core3.amsl.com (Postfix) with ESMTP id 6358D28C287; Wed, 22 Jul 2009 08:57:07 -0700 (PDT)
Received: from localhost (demetrius2.jacobs-university.de [212.201.44.47]) by hermes.jacobs-university.de (Postfix) with ESMTP id 7739FC001B; Wed, 22 Jul 2009 17:55:48 +0200 (CEST)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius2.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id SDthMoUQoB7c; Wed, 22 Jul 2009 17:55:47 +0200 (CEST)
Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 43C54C0007; Wed, 22 Jul 2009 17:55:47 +0200 (CEST)
Received: by elstar.local (Postfix, from userid 501) id 38B24B69435; Wed, 22 Jul 2009 17:55:46 +0200 (CEST)
Date: Wed, 22 Jul 2009 17:55:46 +0200
From: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
To: dharkins@arubanetworks.com, gwz@netcube.com
Message-ID: <20090722155546.GA6013@elstar.local>
Mail-Followup-To: dharkins@arubanetworks.com, gwz@netcube.com, iesg@ietf.org, secdir@ietf.org
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
User-Agent: Mutt/1.5.19 (2009-01-05)
Cc: iesg@ietf.org, secdir@ietf.org
Subject: [secdir] secdir review of draft-harkins-emu-eap-pwd-04.txt
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Jul 2009 15:57:08 -0000
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The draft defines an EAP authentication method using a password. Not being a cryptography expert, I reviewed the document form the perspective of an informed outsider but I did not try to verify whether the cryptographic claims are all correct. That said, I found the document well written and the security discussion convincing. Editorial nits: a) On page 6, you use the acronym PRF and it will help readability if you spell it out here since it has not been introduced yet: s/and a PRF/and a pseudo-random function PRF/ b) In figure 1, you could replace res = PRF(key, i | label | L) K(1) = res with K(1) = PRF(key, i | label | L) res = K(1) since this makes the assignments before the loop and in the loop body symmetric and thus perhaps things easier to read. c) There are two places where IANA assigned values need to be filled into the text; perhaps add more explicit RFC editor instructions so the editor knows what to fill in for 'TBD1'. d) s/DIffie-/Diffie-/ e) You may want to complete reference [BMP00] - the proceedings were published by Springer-Verlag in LNCS 1807. /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 <http://www.jacobs-university.de/>
- [secdir] secdir review of draft-harkins-emu-eap-p… Juergen Schoenwaelder
- Re: [secdir] secdir review of draft-harkins-emu-e… Dan Harkins